CVE-2026-17402 is a critical (CVSS 9.9) OS command injection flaw in IBM API Connect that could let a remote authenticated attacker run arbitrary commands on the underlying host.
What Is It
CVE-2026-17402 is an OS command injection vulnerability (CWE-78) in IBM API Connect. IBM PSIRT says user-supplied input is not properly neutralized before it is passed to the operating system. A remote authenticated attacker could use this to execute arbitrary commands on the host running the product.
NVD published the record on 2026-11-07. Its status is "Awaiting Analysis," so NVD has not yet added its own enrichment.
Why It Matters
IBM rates the flaw 9.9 CRITICAL with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Read plainly, that means:
- Network-reachable with low attack complexity
- Needs only low privileges and no user interaction
- Scope changed: the impact reaches past the vulnerable component to the underlying host
- High impact to confidentiality, integrity and availability
The attacker needs valid credentials, but only at a low privilege level. Many API management deployments have a broad base of authenticated users, such as developers, API consumers and administrators, which makes this bar fairly low. Command execution on the host could expose API traffic, credentials and connected backend systems.
At the time of writing, this CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied sources do not confirm active exploitation.
What's Vulnerable
According to the IBM-supplied NVD record, these IBM API Connect versions are affected:
- 10.0.8.0 through 10.0.8.12
- 12.1.0.0 through 12.1.1.2
Patch Status
IBM has published two support pages for this vulnerability, linked below. The NVD record does not list fixed versions or specific remediation steps, and no CISA required action exists because the CVE is not in KEV.
What to do now:
- Check the IBM advisories for fixed releases and any interim mitigations.
- Find API Connect deployments running affected 10.0.8.x or 12.1.x versions.
- Upgrade first wherever authenticated access is broadly available.
- Until patched, review who holds authenticated access to API Connect.